Data Processing Policy

MASTER SERIES S.A.S. (hereinafter "MASTER SERIES"), with principal offices at Carrera 19 # 82-85, Office 405, Bogotá, Colombia, Phone (601) 742 88 86 ext. 7, as the party responsible for the processing of Personal Data, is a company committed to the protection of the privacy, integrity, security, and confidentiality of all information that may be associated with or related to identified or identifiable natural persons ("Personal Data"), to which it has access in the course of its activities and functions. The Company receives, collects, uses, administers, analyzes, segments, indexes, transmits, transfers, stores, and generally processes Personal Data such as identification data (name, national ID, age, gender), contact data (phone, email, address), visit data, and financial information, among others. Such information may be obtained in the course of and for the development of its accounting, financial, commercial, and legal administration activities and services.

Your personal data is of utmost importance to us and will be processed in accordance with the principles set forth in Law 1581 of 2012 and any other regulations that may amend, replace, or supplement it.

This Data Processing Policy, as required by Law 1581 of 2012 and its complementary regulations (the "Policy"), is intended to: guarantee the rights of Data Subjects; make known the mechanisms and procedures for exercising those rights; identify the person within the Company responsible for handling inquiries, questions, claims, and complaints; and set forth the purposes and processing activities to which Personal Data will be subject in the course of the Company's commercial activities, particularly but not exclusively in connection with the provision of accounting, financial, commercial, and legal administration services.

Please note that MASTER SERIES has entered into franchise agreements with international brands. In this context, the Company promotes and sells the products of such brands in Colombia. However, the processing of your Personal Data is carried out by MASTER SERIES and not by the companies with whom the franchise agreements were executed.

This Policy shall apply to all processing carried out within the territory of the Republic of Colombia by the Company, its employees, suppliers, contractors, and all natural persons with whom it interacts, as well as those with whom the Company agrees to carry out all or part of any activity relating to or connected with the processing of Personal Data for which the Company is the Responsible Party (as defined herein).

The Policy shall apply to third parties with whom the Company may enter into Data Transmission agreements (as defined herein), so that such third parties are aware of the obligations applicable to them, the purposes to which they must adhere, and the security and confidentiality standards they must adopt when processing data on behalf of the Company.

The terms appearing in parentheses and in uppercase throughout this Policy shall have the meaning assigned to them immediately before the parentheses. Any terms not expressly defined herein shall have the meaning assigned to them under the applicable laws and case law of Colombia. Notwithstanding the foregoing, the most relevant terms used in this Policy are defined below:

All processing carried out by the Company, Responsible Parties, Data Processors, and third parties to whom Personal Data is Transferred or Transmitted shall comply with the following principles established by the Law and this Policy, in order to guarantee the right to habeas data of Data Subjects:

In the course of its activities, the Company collects, uses, administers, stores, Transmits, and Transfers Personal Data — including to countries that may not offer adequate levels of protection. Personal Data processed by the Company shall be used exclusively for the following purposes, or those accepted by Data Subjects at the time of collection:

At MASTER SERIES, we use and analyze this personal information for the purposes described below:

• Product and service improvement: Personal Data is used to build user profiles in order to understand how our products and services are used, to develop more relevant and engaging offerings, and to personalize the experience for each user.

• Order processing: Relevant Personal Data (including name, address, and payment details) is used to process and fulfill orders and to provide status updates. Age information may be used to verify minimum age requirements under Colombian law.

• Fraud prevention and credit assessment: Personal Data is used to assess creditworthiness and prevent fraudulent activity.

• Customer service: Information such as order details and contact history is used to process requests and deliver the highest quality of service.

• Products, services, and promotional offerings: Personal Data is used to provide requested products and services, including promotions, loyalty programs, community memberships, events, and mobile applications.

• Promotional programs: Registration data is used to create and manage accounts, send welcome communications, and grant loyalty rewards. Voluntarily provided information is used to improve products and services.

• Direct marketing communications: Marketing communications are sent through the channel of the Data Subject's choice (email, phone, WhatsApp, or social media), subject to applicable consent requirements.

• Personalized messaging: Messages are tailored to individual preferences and interests through the use of data analytics, and may include product information, events, promotions, and surveys.

• Data enrichment: Personal Data from multiple sources may be combined to enhance understanding of user needs and preferences, and to develop more effective marketing campaigns.

• Product and service improvement: Personal Data from multiple sources may be combined to enhance understanding of user needs and preferences, and to develop more effective marketing campaigns.
  • Research and analytics: Personal Data (including anonymized or semi-anonymized derivatives) is used for data science, user experience optimization, product development, performance monitoring, and internal reporting
  • Website analytics: Data collected through cookies and tracking technologies on our website is used to evaluate browsing behavior, identify areas for improvement, and personalize the user experience.
  • Performance analysis: Personal Data is used for financial, sales, and supply chain analytics to assess business performance and identify opportunities for improvement.
  • Improve the user experience across our websites.
  • Provide information, content, and offers tailored to our customers' needs.
  • Conduct general research and statistical analysis.
  • Generate consolidated reports within the MASTER SERIES group of companies.
  • Develop new products and services.
  • Monitor the performance of our products and services and/or improve our technology.
  • Send you personalized marketing communications.
  • Display advertisements on the Internet.
  • Website: Personal information collected through our websites, including through cookies and other tracking technologies, will be used to evaluate browsing behavior on our websites, identify opportunities for improvement, optimize our products and services, and personalize and enhance your experience across our websites and applications.
  • Performance Analysis: We will use your personal information (including by anonymizing it and combining it with the personal information of other customers) for financial, sales, and supply chain analytics to determine whether MASTER SERIES is operating effectively, identify areas for improvement, and, when necessary, report such findings to our parent companies or affiliated entities.
  • WhatsApp Purchases: Information collected through our WhatsApp sales channel will be used to offer you products and discounts, communicate with you regarding any inquiries, and, if you choose to make a purchase through this channel, process your order, arrange delivery to the address you provide, and contact you if any delivery issues arise. The personal information you provide through WhatsApp will be stored in our WhatsApp sales database and linked to the MASTER SERIES. Accordingly, your phone number, email address, delivery address, and any other personal information you provide through WhatsApp may be stored in both databases.
  • We will request your consent if we wish to use your personal information for purposes other than those described in this Privacy Policy, where required by applicable law.

Additional processing purposes include:

• Use the information provided to verify the background of the individuals and legal entities with whom the Company or its managed clients interact.

• Comply with the Company's and its clients' internal processes regarding the management of suppliers and contractors.

• Carry out record-keeping, system updates, and the protection and safeguarding of information and databases.

• Conduct internal verification processes for background checks

• Perform analyses to control and prevent fraud and money laundering, including, but not limited to, consulting and reporting to restricted lists and financial risk information databases.

• Manage the Company's human resources, including, but not limited to, evaluating candidates interested in employment with the Company, employee hiring, training processes, performance evaluations, employee welfare and occupational health programs, issuance of employment certificates, provision of employment references upon request, maintenance of the Company's workforce records, and payroll processing, where applicable. Conduct information update cam

• Conduct information update campaigns to ensure the integrity of personal data.

• Conduct internal investigations to ensure compliance with the Company's policies in cases of suspicious activities that may affect the Company's reputation (applicable only to employees or service providers of the Company).

• Conduct customer satisfaction surveys.

• Notify data subjects of amendments to this Policy and request new authorizations for the Processing of Personal Data, where applicable.

• Carry out any other purposes determined by the Data Controllers during the collection of Personal Data for its Processing, in order to comply with legal and regulatory obligations and support the Company's business activities.

• Manage payroll for other companies or entities pursuant to service agreements with clients.

• Manage the accounting activities of other companies or entities pursuant to service agreements with clients.

• Manage the commercial and legal affairs of other companies or entities pursuant to service agreements with clients.

• Provide consulting, advisory, oversight, and investigation services.

• Access the databases of clients, contractors, suppliers, and third parties who may be interested in purchasing the Company's services.

• Implement commercial channels connecting clients, suppliers, and other relevant individuals or legal entities to support the Company's business activities.

• Develop new administration, consulting, and business development services

• Carry out factoring activities (including accounts receivable purchases and discounting transactions involving securities and commercial paper).

• Supplement the information provided and, in general, carry out the activities necessary to manage requests, complaints, and claims submitted by the Company's clients and third parties, and forward them to the departments responsible for issuing the corresponding responses.

In accordance with the Law, Data Subjects have the following rights:

Data Subjects may exercise their rights by presenting a valid national ID or other identification document. Minors may exercise their rights personally or through their parents or legal guardians, who must provide appropriate supporting documentation.

In the course of its commercial activities, the Company may collect and process Sensitive Data, including photographs, videos, and voice recordings, as well as medical information and images.

Other Sensitive Data relating to health, sexual life, or any information whose processing may affect privacy or involve discrimination may also be processed. In such cases, Data Subjects will be informed and asked to provide separate, freely given consent.

Sensitive Data will be processed with the utmost diligence and the highest security standards. Access to Sensitive Data will be strictly limited to authorized personnel.

Authorization for the processing of Sensitive Data is entirely optional.No activity will be conditioned upon the provision of Sensitive Data, and the Data Subject's decision not to authorize such processing will be fully respected.

Please note: As of the date of this Policy, MASTER SERIES has not processed sensitive data and does not anticipate doing so in the future.

All Processing must be preceded by the obtaining of Authorization. Prior to the collection of Personal Data, the Company must obtain a signed Authorization from the Data Subject and retain a copy for future reference.

The Company has a department responsible for receiving and handling Requests, Complaints, and Claims related to Personal Data, in accordance with the Law, the Manual, and this Policy. Some of the specific responsibilities of this department with respect to Personal Data include:

• Receiving and processing all requests submitted by Data Subjects, and handling and responding to those supported by applicable law or this Policy, including, but not limited to: requests to update Personal Data; requests to access Personal Data; requests for the deletion of Personal Data; requests to revoke authorization where such revocation is permitted under Decree 1377; requests for information regarding the Processing and purposes of their Personal Data; and requests to obtain proof of the authorization granted, where required by law.

• Responding to Data Subjects regarding requests that cannot be processed in accordance with applicable law.

The contact information is as follows:

1. Inquiries (SEE APPENDIX 1).

The Company provides multiple channels through which Data Subjects, Legitimate Parties, or legal representatives of minor Data Subjects may submit inquiries regarding: (i) their Personal Data held in the Company's Databases; (ii) the Processing to which it is subject; and (iii) the purposes being pursued. Inquiries about:

• Inquiries may be submitted in person or electronically. The Company will retain proof of each inquiry and its response.
• Prior to responding, the responsible officer will verify the identity of the Data Subject or Legitimate Party and the Authorization or contract giving rise to the Processing.
• The purposes to be fulfilled.

These mechanisms may be physical, such as in-person requests, or electronic, such as requests submitted by email. Regardless of the method used, the Company will retain evidence of both the inquiry and its response.

Before processing the inquiry, the person responsible for handling it will verify:

1. The identity of the Data Subject or Authorized Representative. For this purpose, the Company will require the Data Subject's national identification card or other original identification document, as well as any special or general powers of attorney, where applicable.
2. The authorization or contract with third parties that gave rise to the Company's Processing of the Personal Data.
3. The date on which the inquiry was received by the Company.

If the requester is authorized to submit the inquiry, the person responsible for handling it will compile all information relating to the Data Subject contained in that individual's record or otherwise associated with the Data Subject's identification within the Company's Databases. Once the information has been compiled, it will be provided to the Data Subject so that they may access and review it.

The person responsible for handling the inquiry will respond to the requester, provided that the requester is entitled to receive such information as the Data Subject, the Authorized Representative, or the legal representative in the case of minors. The response will be issued within ten (10) business days from the date on which the inquiry was received by the Company.

This response shall be mandatory even in cases where it is determined that the requester is not authorized to submit the inquiry. In such cases, the requester shall be informed accordingly and given the opportunity to demonstrate their legitimate interest and authority by providing additional supporting documentation.

If the inquiry cannot be addressed within ten (10) business days, the requester will be contacted and informed of the reasons for the delay, as well as the date on which the inquiry will be resolved. Under no circumstances may this extension exceed five (5) additional business days following the expiration of the initial term. The Company will use the same communication channel, or a similar one, through which the inquiry was submitted.

A final response to all inquiries shall be provided within fifteen (15) business days from the date on which the initial inquiry was received by the Company. Accordingly, the Company will monitor all inquiries submitted to ensure timely resolution.

2. Claims (VER ANEXO 2)

The Company provides channels through which Data Subjects, Legitimate Parties, or legal representatives may CLAIMS submit claims regarding:

• (i) Personal Data requiring correction, update, or deletion;
• or (ii) alleged non-compliance with the Company's legal obligations.

Claims must be submitted to the Legal Department at juridica@masterseries.com.co or in writing to Carrera 19 # 82-85, Office 405, Bogotá, and must include: the Data Subject's name and ID number; a description of the facts giving rise to the claim and the relief sought; the claimant's contact information; and any supporting documentation.

If the claim or supporting documentation is incomplete, the Company will notify the claimant within five (5) days to remedy the deficiency.

• Claims must be submitted to the Legal Department at juridica@masterseries.com.co or in writing to Carrera 19 # 82-85, Office 405, Bogotá.
• The claim must include the Data Subject's name and identification number, a description of the facts giving rise to the claim and the relief sought (such as updating, correcting, deleting data, or enforcing legal obligations), the claimant's contact information, and any supporting documentation.
• The claim must specify the claimant's address, contact information, and identification.
• The claim must be accompanied by all supporting documentation the claimant intends to rely upon.
• Deberá acompañarse de toda la documentación que el reclamante quiera hacer valer.

Before processing the claim, the person responsible for handling it will verify:

1. The identity of the Data Subject or the Data Subject's representative. For this purpose, the Company may require the Data Subject's national identification card or other original identification document, as well as any special or general powers of attorney, where applicable.
2. The authorization or contract with third parties that gave rise to the Company's Processing of the Personal Data.
3. The date on which the claim was received.
4. If the claim or the supporting documentation is incomplete, the Company will request that the claimant correct the deficiencies in a single notice issued within five (5) business days following receipt of the claim. If the claimant fails to provide the required information or documentation within two (2) months from the date of the initial claim, the claim shall be deemed withdrawn.
5. If, for any reason, the person who receives the claim within the Company is not competent to resolve it, the claim shall be forwarded to the Data Protection Department – Legal Department within two (2) business days after its receipt, and the claimant shall be informed of such referral.
6. Once a complete claim has been received, the Company shall include in the Database containing the Data Subject's Personal Data a notation stating "Claim Pending", together with the reason for the claim, within a period not exceeding two (2) business days.This notation shall remain in place until the claim has been resolved.
7. The maximum period for resolving a claim shall be fifteen (15) business days , counted from the business day following its receipt. If it is not possible to resolve the claim within this period, the claimant shall be informed of the reasons for the delay and the date on which the claim will be resolved. Under no circumstances may this extension exceed eight (8) additional business days following the expiration of the initial term.

For a graphical overview of our procedures and response timelines for inquiries and claims, please refer to the Appendices to this Policy.

This Policy shall become effective on July 1, 2024. Personal Data processed by the Company shall remain in its Databases for as long as necessary to fulfill the purposes set forth in this Policy and for which such Personal Data was collected, in accordance with the principle of storage limitation. Accordingly, the retention period of the Databases is directly related to the purposes for which the Personal Data was collected.

This Policy may be amended from time to time by the Company and shall form part of any agreements entered into by the Company where applicable. Any amendment to this Policy shall be governed by the Company's Quality Management System and communicated in advance to the Data Subjects through the means available for such purpose, including the Company's website and/or email communications. A substantial amendment includes, but is not limited to, the following circumstances:

1. A change in the identification of the department, division, or person responsible for handling inquiries and claims.
2. A material change to the purposes of Processing that may affect the Authorization. In such cases, the Company will obtain a new Authorization.

Any amendments will be published on the Company's website and/or communicated by email to the Data Subjects, provided that the Company has their contact information available.